]> git.ipfire.org Git - thirdparty/qemu.git/commit
ehci: make idt processing more robust
authorGerd Hoffmann <kraxel@redhat.com>
Mon, 14 Dec 2015 08:21:23 +0000 (09:21 +0100)
committerMichael Roth <mdroth@linux.vnet.ibm.com>
Tue, 15 Mar 2016 17:07:11 +0000 (12:07 -0500)
commit0d335804e31b2d93935c957893f4007678390f98
treed20d61cd823147dbe6b38b30c7f73410a6edf4a3
parenta8c40fa2d667e585382080db36ac44e216b37a1c
ehci: make idt processing more robust

Make ehci_process_itd return an error in case we didn't do any actual
iso transfer because we've found no active transaction.  That'll avoid
ehci happily run in circles forever if the guest builds a loop out of
idts.

This is CVE-2015-8558.

Cc: qemu-stable@nongnu.org
Reported-by: Qinghao Tang <luodalongde@gmail.com>
Tested-by: P J P <ppandit@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 156a2e4dbffa85997636a7a39ef12da6f1b40254)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
hw/usb/hcd-ehci.c